CVE-2026-68924: MobSF Denial of Service Vulnerability

CVE-2026-68924 Overview

CVE-2026-68924 is a resource exhaustion vulnerability in Mobile Security Framework (MobSF), a mobile application security testing tool. The flaw exists in the unzip function within mobsf/StaticAnalyzer/views/common/shared_func.py. The function logs when an archive member exceeds ZIP_MAX_UNCOMPRESSED_FILE_SIZE but fails to skip to the next member. An authenticated user can upload a crafted ZIP or APK containing an oversized member, which then gets extracted to disk. This behavior can exhaust available disk space and prevent further scans from executing. The issue affects MobSF versions prior to 4.5.1 and is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
An authenticated user can upload a crafted archive to exhaust disk space on the MobSF host, preventing further security scans and disrupting availability.

Affected Products

Mobile Security Framework (MobSF) versions prior to 4.5.1
MobSF Static Analyzer component (mobsf/StaticAnalyzer/views/common/shared_func.py)
MobSF deployments accepting authenticated ZIP or APK uploads

Discovery Timeline

2026-08-18 - CVE-2026-68924 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-68924

Vulnerability Analysis

MobSF processes uploaded archives through an unzip routine that enforces two size limits. The ZIP_MAX_UNCOMPRESSED_FILE_SIZE limit governs individual archive members. The ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit governs the aggregate uncompressed size. When a single member exceeds the per-file limit, the function emits a log entry indicating the member is being skipped. However, execution flow does not include a continue statement to advance to the next member. The oversized member is therefore extracted to disk regardless of the intended skip logic. An authenticated attacker can chain this behavior by staying under the aggregate size limit while embedding an oversized member. The result is exhausted disk space and denial of service for subsequent scans.

Root Cause

The root cause is a missing control-flow statement in the archive extraction loop. The developer intended to skip oversized members after logging, but the loop proceeds to write the file. This is a classic logic error where a log-and-skip pattern was implemented as log-only.

Attack Vector

Exploitation requires authenticated access to a MobSF instance. The attacker crafts a ZIP or APK archive containing at least one member with an uncompressed size exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE. The aggregate uncompressed size must remain below ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE to avoid the outer check. Uploading this archive through the normal analysis interface triggers extraction of the oversized member. Repeated uploads amplify the disk consumption until the volume is exhausted.

The fix landed in the v4.5.1 release. Related security hardening from the same release cycle refactored security utilities into a dedicated module:

python

 from mobsf.DynamicAnalyzer.views.common.shared import (
     invalid_params,
-    is_attack_pattern,
     send_response,
 )
+from mobsf.MobSF.security import is_attack_pattern
 from mobsf.DynamicAnalyzer.views.android.environment import (
     Environment,
 )
+from mobsf.MobSF.security import cmd_injection_check
 from mobsf.MobSF.utils import (
-    cmd_injection_check,
     docker_translate_localhost,
     get_adb,
     get_device,

Source: GitHub Commit 62563ca

Detection Methods for CVE-2026-68924

Indicators of Compromise

Rapid growth in disk usage on the MobSF host volume, particularly under directories used for uploaded sample extraction.
MobSF application logs containing repeated messages indicating an archive member exceeded ZIP_MAX_UNCOMPRESSED_FILE_SIZE.
Failed scan initiations or errors referencing insufficient disk space following authenticated uploads.
Uploads of ZIP or APK files containing single members with unusually large uncompressed sizes.

Detection Strategies

Monitor MobSF upload endpoints for authenticated users submitting archives with anomalous compression ratios or large declared member sizes.
Correlate MobSF log entries flagging oversized members with subsequent disk utilization spikes.
Baseline expected scan volume per user and alert on deviations in upload frequency or archive size distribution.

Monitoring Recommendations

Configure filesystem alerts on the MobSF working directory to trigger at 70% and 90% capacity thresholds.
Forward MobSF application logs to a centralized logging platform for correlation with disk metrics.
Track authenticated MobSF sessions and record uploaded file hashes for post-incident review.

How to Mitigate CVE-2026-68924

Immediate Actions Required

Upgrade MobSF to version 4.5.1 or later, which contains the fix to the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py.
Restrict MobSF access to trusted analysts only, as exploitation requires authentication.
Audit recent uploads and MobSF logs for entries indicating oversized archive members were processed.

Patch Information

The vulnerability is fixed in MobSF v4.5.1. Review the GitHub Security Advisory GHSA-x768-8642-mmq9, the GitHub Pull Request 2627, and the GitHub Release v4.5.1 for details.

Workarounds

Enforce strict disk quotas on the MobSF service account or container to cap total consumption if patching is delayed.
Deploy MobSF within an isolated container or virtual machine with a dedicated volume so exhaustion does not impact other services.
Limit which users can authenticate to MobSF and require multi-factor authentication for accounts that submit samples.

bash

# Upgrade MobSF to the patched release
pip install --upgrade mobsf==4.5.1

# Or pull the patched Docker image
docker pull opensecurity/mobile-security-framework-mobsf:v4.5.1